Trait CryptoProvider 

pub trait CryptoProvider: Send + Sync {
    // Required methods
    fn name(&self) -> &'static str;
    fn supports(&self, capability: ProviderCapability<'_>) -> bool;
    fn fill_random(&self, output: &mut [u8]) -> Result<(), ProviderError>;
    fn digest(
        &self,
        algorithm: DigestAlgorithm,
        data: &[u8],
    ) -> Result<Vec<u8>, ProviderError>;
    fn sign(
        &self,
        key: &dyn SigningKey,
        algorithm: SignatureAlgorithm,
        data: &[u8],
    ) -> Result<Vec<u8>, SigningKeyError>;
    fn verify(
        &self,
        key: &dyn VerifyingKey,
        algorithm: SignatureAlgorithm,
        data: &[u8],
        signature: &[u8],
    ) -> Result<bool, DsigError>;
    fn encrypt_data(
        &self,
        algorithm: DataEncryptionAlgorithm,
        key: &[u8],
        plaintext: &[u8],
    ) -> Result<Vec<u8>, ProviderError>;
    fn decrypt_data(
        &self,
        algorithm: DataEncryptionAlgorithm,
        key: &[u8],
        ciphertext: &[u8],
    ) -> Result<Vec<u8>, ProviderError>;
    fn wrap_key(
        &self,
        algorithm: KeyWrapAlgorithm,
        kek: &[u8],
        key: &[u8],
    ) -> Result<Vec<u8>, ProviderError>;
    fn unwrap_key(
        &self,
        algorithm: KeyWrapAlgorithm,
        kek: &[u8],
        wrapped: &[u8],
    ) -> Result<Vec<u8>, ProviderError>;
    fn transport_key(
        &self,
        key: &dyn KeyTransportKey,
        parameters: &RsaOaepParameters,
        plaintext: &[u8],
    ) -> Result<Vec<u8>, ProviderError>;
    fn recover_key(
        &self,
        key: &dyn KeyRecoveryKey,
        parameters: &RsaOaepParameters,
        ciphertext: &[u8],
    ) -> Result<Vec<u8>, ProviderError>;
    fn derive_key(
        &self,
        parameters: &KdfParameters<'_>,
        secret: &[u8],
    ) -> Result<Vec<u8>, ProviderError>;

    // Provided methods
    fn verify_x509_signature(
        &self,
        algorithm: X509SignatureAlgorithm,
        signed_data: &[u8],
        signature: &[u8],
        issuer_spki_der: &[u8],
    ) -> Result<bool, ProviderError> { ... }
    fn agree_key(
        &self,
        key: &dyn KeyAgreementKey,
        parameters: &KeyAgreementParameters<'_>,
    ) -> Result<Vec<u8>, ProviderError> { ... }
    fn require_capability(
        &self,
        capability: ProviderCapability<'_>,
    ) -> Result<(), ProviderError> { ... }
}

Stateless provider operations used by the XML Security pipelines.

Required Methods

fn name(&self) -> &'static str

Stable provider name for diagnostics and capability reporting.

fn supports(&self, capability: ProviderCapability<'_>) -> bool

Return whether this build supports the requested operation and parameters.

fn fill_random(&self, output: &mut [u8]) -> Result<(), ProviderError>

Fill caller-owned output with cryptographically secure random bytes.

fn digest( &self, algorithm: DigestAlgorithm, data: &[u8], ) -> Result<Vec<u8>, ProviderError>

Compute a message digest.

fn sign( &self, key: &dyn SigningKey, algorithm: SignatureAlgorithm, data: &[u8], ) -> Result<Vec<u8>, SigningKeyError>

Sign bytes with an opaque key handle.

Providers that delegate primitive signing to the supplied key must call crate::xmldsig::SigningKey::sign_with_provider so randomized primitives consume this provider’s randomness.

fn verify( &self, key: &dyn VerifyingKey, algorithm: SignatureAlgorithm, data: &[u8], signature: &[u8], ) -> Result<bool, DsigError>

Verify bytes with an opaque key handle.

The XMLDSig facade validates algorithm- and key-specific signature framing before this provider boundary.

fn encrypt_data( &self, algorithm: DataEncryptionAlgorithm, key: &[u8], plaintext: &[u8], ) -> Result<Vec<u8>, ProviderError>

Encrypt XMLEnc content bytes, including standard framing.

fn decrypt_data( &self, algorithm: DataEncryptionAlgorithm, key: &[u8], ciphertext: &[u8], ) -> Result<Vec<u8>, ProviderError>

Decrypt XMLEnc content bytes, including framing validation.

fn wrap_key( &self, algorithm: KeyWrapAlgorithm, kek: &[u8], key: &[u8], ) -> Result<Vec<u8>, ProviderError>

Wrap a content key with RFC 3394 AES Key Wrap.

Successful output contains the complete RFC 3394 value and is exactly eight bytes longer than key. The XMLEnc facade validates that framing before serializing provider output.

fn unwrap_key( &self, algorithm: KeyWrapAlgorithm, kek: &[u8], wrapped: &[u8], ) -> Result<Vec<u8>, ProviderError>

Unwrap a content key with RFC 3394 AES Key Wrap.

fn transport_key( &self, key: &dyn KeyTransportKey, parameters: &RsaOaepParameters, plaintext: &[u8], ) -> Result<Vec<u8>, ProviderError>

Wrap key bytes using an opaque RSA public-key operation.

fn recover_key( &self, key: &dyn KeyRecoveryKey, parameters: &RsaOaepParameters, ciphertext: &[u8], ) -> Result<Vec<u8>, ProviderError>

Recover key bytes using an opaque RSA private-key operation.

fn derive_key( &self, parameters: &KdfParameters<'_>, secret: &[u8], ) -> Result<Vec<u8>, ProviderError>

Derive key bytes from caller-owned secret material.

Implementations that advertise ProviderCapability::Kdf must perform the advertised derivation here. This method is required so capability discovery cannot silently inherit a contradictory unsupported default.

Provided Methods

fn verify_x509_signature( &self, algorithm: X509SignatureAlgorithm, signed_data: &[u8], signature: &[u8], issuer_spki_der: &[u8], ) -> Result<bool, ProviderError>

Verify an X.509 certificate or CRL signature under its issuer SPKI.

fn agree_key( &self, key: &dyn KeyAgreementKey, parameters: &KeyAgreementParameters<'_>, ) -> Result<Vec<u8>, ProviderError>

Perform key agreement with an opaque provider-owned private key.

fn require_capability( &self, capability: ProviderCapability<'_>, ) -> Result<(), ProviderError>

Reject an unavailable exact capability without falling back.

Dyn Compatibility

This trait is dyn compatible.

In older versions of Rust, dyn compatibility was called "object safety".

Implementors

impl CryptoProvider for RustCryptoProvider